Arslan Law Firm

The law on protection of personal data is a branch of law that deals with the protection of the fundamental rights and freedoms of individuals, especially the privacy of private life, and the obligations of natural and legal persons who process personal data. In this context, with our experienced and expert team, we guide our clients in all kinds of transactions that can be performed on data such as obtaining, saving, storing, rearranging, clarifying, sharing, and destruction of personal data belonging to natural persons and special quality data within the Law No. 6698. Also we ensure that necessary measures are taken. 

The person who determines the purposes and means of the processing of personal data, and who is responsible for establishment and management of the filing system is be named as data controller and natural person whose personal data are processed is be named as data subject. Any data that makes a person identifiable/selectable is considered as personal data. Identity information of the relevant person, contact information, financial information, professional experience information, visual and audio recordings, data obtained with a camera or sound recorder, information obtained within the scope of marketing activity, transaction security information, clothing size information, shoe number information, location information, personal information, etc. are personal data. On the other hand special categories of personal data are, data such as all kinds of health information, blood group information, physical examination result, medical history, criminal record of the person concerned, religious information, all kinds of biometric data, political opinion information and etc.

The most important point regarding the processing of personal data and special categories of personal data by data controllers is to clarify the person about the processed data. Each data controller is obliged to clarify the relevant persons about in terms of the data they process. This clarification can be done in writing for conclusive force. As Arslan Law, on behalf of the data controllers, we organize detailed informative texts that contain all the elements required in the law to clarify the groups of people about the categories of data they process. We ensure that data controllers fulfill their obligation to clarify arising from the law. For example, if the phone calls made with the client company are recorded, the clarification of the real person whom the phone call is made about voice recording has been made, camera records taken of visitors visiting the client company address, if requested at the entrance, clarification on personal data processed such as identity information,  clarification of the customers with whom it has commercial relations about the personal data processed, clarification of the customers who shop on the website, visit the website and / or become members about the processed personal data by e-commerce client company and etc. In accordance with such situations that create a clarify obligation, we arrange clarification texts for our clients in accordance with the conditions requested for the Law No. 6698 and the Personal Data Protection Authority. In addition, we review all kinds of contracts, signed or to be signed with the companies, according to the Law No. 6698 and make the necessary revisions.

Personal data cannot be processed without the explicit consent of the data subject. If the data subject does not explicitly declare it’s consent for the processing of it’s personal data by the data controller, processing personal data belonging to the person will be illegal. On the other hand, there are exceptional cases where explicit consent is not required for the processing of personal data by a data controller(according to Law No.6698 article 5). For example, as an employer company, when you conclude an employment contract with a staff member, you request many documents along with the employment contract from the staff so that they can be hired.  With these documents provided by the staff member, you have to process many personal data of the staff person. However, in the stated law article, “It is necessary to process the personal data of parties of a contract, provided that the processing is directly related to the execution or performance of the contract” It has been regulated that there is no need to obtain explicit consent from the personnel regarding the processed personal data of the personnel based on legal reasons. On the other hand, the law did not require the legal reasons for special categories of personal data which it requires for personal data. The purpose of this situation The purpose of this situation is to prevent the processing of special categories of personal data by anyone without the explicit consent of the person because this data may lead to discrimination in society. For example, if the other party requests your criminal record while concluding a contract, that party cannot process, record, disclose or share any of your criminal records without your explicit consent. Therefore, today, data controllers should be extremely careful about the processing of personal and special categories of personal data of the data subjects. Because the board imposes serious fines on many leading companies for illegally processing or sharing data. If you think that that your data is illegally processed, stored, shared, etc. , in order to prevent violations, we carry out the process in accordance with the procedures specified in the law. The main thing is not to process, store, save, share(or etc.) data illegally as a data controller. Preventing a criminal liability of the data controller by fulfilling the obligations required by the law and other legislation in this regard and preventing the data subjects from being harmed by the illegal processing of their data are the main purposes. 

In the light of the above, the data controllers who are obliged to register with the VERBIS registration system have to create a data inventory about the data categories processed, the purpose of the data, to whom the data is transferred and for how long, before registering with VERBIS. This created data inventory enables data controllers to register to VERBIS more accurately and quickly. The protection of personal data is a situation that is very important in every field today and gives importance to the right of privacy. The text that need to be prepared by focusing on the current situation in the company and contracts, which is concluded or to be concluded, should be studied carefully for protect the data of employees, visitors, customers, managers and third persons. Since the printed texts will not provide sufficient data security, they will not prevent the company from being legally responsible in the future.